Summary
A remote code execution vulnerability exists in VS Code 1.141.0 and earlier affected versions when using GitHub Copilot agent sessions backed by the local Copilot harness. The harness could automatically approve edits to enabled custom hook and agent-definition locations configured through chat.hookFilesLocations or chat.agentFilesLocations, treating them as ordinary workspace files.
Details
An attacker who can influence an agent through malicious content or prompt injection could cause the agent to add a shell command to one of these files without showing the expected approval prompt. The command could then execute with the user's privileges when the affected hook is subsequently invoked. Exploitation requires the user to have an affected custom location and hooks enabled and to run a Copilot-harness session against attacker-controlled content.
Patches
The fix is included in VS Code 1.141.1. The patch (initial permission hardening and workbench Chat follow-up) treats enabled workspace-relative hook and agent-definition locations as sensitive edit locations.
Direct writes and shell redirections targeting these locations now require confirmation instead of being automatically approved under normal permission settings. The protection applies to Copilot-harness sessions in both the Agents Window and the regular workbench Chat experience. It also accounts for multi-root workspaces, symbolic links, case-insensitive paths, and configuration changes made while a session is running.
Workarounds
Until VS Code 1.141.1 is available, disable chat hooks by setting chat.useHooks and chat.useClaudeHooks to false. Alternatively, remove or disable custom entries in chat.hookFilesLocations and chat.agentFilesLocations.
Avoid running Copilot-harness agent sessions against untrusted workspaces or attacker-controlled content. Do not approve unexpected changes to hook configuration files or agent definitions.
References
Summary
A remote code execution vulnerability exists in VS Code 1.141.0 and earlier affected versions when using GitHub Copilot agent sessions backed by the local Copilot harness. The harness could automatically approve edits to enabled custom hook and agent-definition locations configured through
chat.hookFilesLocationsorchat.agentFilesLocations, treating them as ordinary workspace files.Details
An attacker who can influence an agent through malicious content or prompt injection could cause the agent to add a shell command to one of these files without showing the expected approval prompt. The command could then execute with the user's privileges when the affected hook is subsequently invoked. Exploitation requires the user to have an affected custom location and hooks enabled and to run a Copilot-harness session against attacker-controlled content.
Patches
The fix is included in VS Code 1.141.1. The patch (initial permission hardening and workbench Chat follow-up) treats enabled workspace-relative hook and agent-definition locations as sensitive edit locations.
Direct writes and shell redirections targeting these locations now require confirmation instead of being automatically approved under normal permission settings. The protection applies to Copilot-harness sessions in both the Agents Window and the regular workbench Chat experience. It also accounts for multi-root workspaces, symbolic links, case-insensitive paths, and configuration changes made while a session is running.
Workarounds
Until VS Code 1.141.1 is available, disable chat hooks by setting
chat.useHooksandchat.useClaudeHookstofalse. Alternatively, remove or disable custom entries inchat.hookFilesLocationsandchat.agentFilesLocations.Avoid running Copilot-harness agent sessions against untrusted workspaces or attacker-controlled content. Do not approve unexpected changes to hook configuration files or agent definitions.
References